# Use a descriptive name for your cluster
cluster.name: {{ elk_cluster_name }}

# Use a descriptive name for the node
node.name: "${HOSTNAME}.node.consul"

# Node roles
node.roles:
{% for role in node_roles %}
  - "{{ role }}"
{% endfor %}

# Set a custom paths for data, logs, and snapshots
path.data: "{{ elasticsearch_data_path }}"
path.logs: "{{ elasticsearch_logs_path }}"
path.repo: "{{ elasticsearch_snapshot_path }}"

# Lock the memory on startup
bootstrap.memory_lock: {{ (ansible_memtotal_mb <= 8192) | ternary('false', 'true') | lower }}

# Network and HTTP
network.host: "0.0.0.0"
network.bind_host: "${HOSTNAME}.node.consul"
network.publish_host: "${HOSTNAME}.node.consul"

# Disable geoip download in air-gapped environments
ingest.geoip.downloader.enabled: false

# Enable security
xpack.security.enabled: true

# Transport security
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.key: "{{ elasticsearch_config_path }}/certs/${HOSTNAME}/${HOSTNAME}.key"
xpack.security.transport.ssl.certificate: "{{ elasticsearch_config_path }}/certs/${HOSTNAME}/${HOSTNAME}.crt"
xpack.security.transport.ssl.certificate_authorities: "{{ elasticsearch_config_path }}/certs/ca/ca.crt"
xpack.security.transport.ssl.verification_mode: none
xpack.security.transport.ssl.client_authentication: optional
xpack.security.transport.ssl.key_passphrase: "{{ elasticsearch_ca_pass }}"

# SSL security
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: "{{ elasticsearch_config_path }}/certs/${HOSTNAME}/${HOSTNAME}.key"
xpack.security.http.ssl.certificate: "{{ elasticsearch_config_path }}/certs/${HOSTNAME}/${HOSTNAME}.crt"
xpack.security.http.ssl.certificate_authorities: "{{ elasticsearch_config_path }}/certs/ca/ca.crt"
xpack.security.http.ssl.verification_mode: none
xpack.security.http.ssl.client_authentication: optional
xpack.security.http.ssl.key_passphrase: "{{ elasticsearch_ca_pass }}"

# Read the $ES_HOME/config/unicast_hosts file to find out the list of master nodes
discovery.seed_providers: file

